Hi Daniel,
The issue was that acme.sh was ignoring my KNOT_SERVER choice and was using the option
saved into account.conf instead.
Now I've adjusted it to use souseiseki, it works (as direct update works).
So yes, the update doesn't contain TSIG in
the case of souseiseki.
Is it possible for the update to contain TSIG when
forwarding an update?
It depends on your configuration. Knot should be compliant with